dharma | d13c712deac973ddd3666c02b76e8c0f2f5a4291078b579e231cdb8f5554efb2

General

Target

program.exe
Size

92KB
MD5

b2eff93d16267edd3817eee2a40c7eee
SHA1

8489a94af0c4b9a7fd53affd64a3357141995c3a
SHA256

d13c712deac973ddd3666c02b76e8c0f2f5a4291078b579e231cdb8f5554efb2
SHA512

8abc98b506e977cd7958ccedefdc783be016ef3482ada047584fa8edb73ac5cff87a46c644fbb9b10c2b790399b51a6768db4762f9e5069ca04182473fbc4a2d

Score

10^/10

dharma persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail rdphack@onionmail.org Write this ID in the title of your message D9ED6A9C In case of no answer in 24 hours write us to theese e-mails: freelurk@aol.com You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

rdphack@onionmail.org

freelurk@aol.com

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Drops startup file 5 IoCs

Processes:

program.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	program.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	program.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\program.exe	program.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

program.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	program.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	program.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\program.exe = "C:\\Windows\\System32\\program.exe"	program.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

program.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	program.exe
File opened for modification	C:\Users\Public\desktop.ini	program.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	program.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	program.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	program.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	program.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	program.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SLC8MVWU\desktop.ini	program.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	program.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2MTLR0RV\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	program.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	program.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	program.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	program.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	program.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	program.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2513283230-931923277-594887482-1000\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQE06QBJ\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	program.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	program.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	program.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	program.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	program.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\XVLP3GFJ\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AJ1NIV9I\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	program.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	program.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\93PHUZFG\desktop.ini	program.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	program.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VLFEZDK1\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	program.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	program.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	program.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	program.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	program.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MLS6OOW4\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	program.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	program.exe
File opened for modification	C:\Program Files\desktop.ini	program.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	program.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	program.exe

Drops file in System32 directory 2 IoCs

Processes:

program.exe

description ioc process

File created C:\Windows\System32\program.exe program.exe
File created C:\Windows\System32\Info.hta program.exe

description	ioc	process
File created	C:\Windows\System32\program.exe	program.exe
File created	C:\Windows\System32\Info.hta	program.exe

Drops file in Program Files directory 64 IoCs

Processes:

program.exe

description	ioc	process
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_few-showers.png	program.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Enderbury	program.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR31F.GIF	program.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR26F.GIF.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187829.WMF.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libes_plugin.dll.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png	program.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099169.WMF.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200383.WMF	program.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\fa.pak.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar	program.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Menominee.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\OMSINTL.DLL.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB10.BDR	program.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01154_.WMF.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsound.dll	program.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiling.jar	program.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00559_.WMF.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00270_.WMF.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0086478.WMF.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02740U.BMP.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143754.GIF.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115866.GIF.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ContactPicker.dll.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)redStateIcon.png	program.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe Root Certificate.cer.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files\Java\jre7\bin\instrument.dll.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCOUPON.DPV.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_docked.png	program.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tahiti.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libparam_eq_plugin.dll	program.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime.css.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR3B.GIF.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File created	C:\Program Files\Java\jre7\bin\unpack.dll.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15022_.GIF.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\VISSHE.DLL.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png	program.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107496.WMF.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\SONORA.INF	program.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Luis.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGAD.DPV.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_windy.png	program.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\Office64MUI.XML.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar	program.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\TRANSMGR.DLL	program.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Argentina\La_Rioja.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CLASSIC1.WMF	program.exe
File created	C:\Program Files\Java\jre7\lib\accessibility.properties.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02791_.WMF	program.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSans.ttf	program.exe
File created	C:\Program Files\Java\jre7\lib\zi\MST.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02201_.GIF.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14581_.GIF	program.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DiscussionToolIconImagesMask.bmp	program.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIGN.XML	program.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Right.accdt.id-D9ED6A9C.[rdphack@onionmail.org].rdp	program.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

1240 vssadmin.exe
672 vssadmin.exe

pid	process
1240	vssadmin.exe
672	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

program.exe

pid	process
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe
772	program.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1364 vssvc.exe
Token: SeRestorePrivilege 1364 vssvc.exe
Token: SeAuditPrivilege 1364 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	1364	vssvc.exe
Token: SeRestorePrivilege	1364	vssvc.exe
Token: SeAuditPrivilege	1364	vssvc.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

program.execmd.execmd.exe

description	pid	process	target process
PID 772 wrote to memory of 2036	772	program.exe	cmd.exe
PID 772 wrote to memory of 2036	772	program.exe	cmd.exe
PID 772 wrote to memory of 2036	772	program.exe	cmd.exe
PID 772 wrote to memory of 2036	772	program.exe	cmd.exe
PID 2036 wrote to memory of 1784	2036	cmd.exe	mode.com
PID 2036 wrote to memory of 1784	2036	cmd.exe	mode.com
PID 2036 wrote to memory of 1784	2036	cmd.exe	mode.com
PID 2036 wrote to memory of 1240	2036	cmd.exe	vssadmin.exe
PID 2036 wrote to memory of 1240	2036	cmd.exe	vssadmin.exe
PID 2036 wrote to memory of 1240	2036	cmd.exe	vssadmin.exe
PID 772 wrote to memory of 992	772	program.exe	cmd.exe
PID 772 wrote to memory of 992	772	program.exe	cmd.exe
PID 772 wrote to memory of 992	772	program.exe	cmd.exe
PID 772 wrote to memory of 992	772	program.exe	cmd.exe
PID 992 wrote to memory of 1660	992	cmd.exe	mode.com
PID 992 wrote to memory of 1660	992	cmd.exe	mode.com
PID 992 wrote to memory of 1660	992	cmd.exe	mode.com
PID 992 wrote to memory of 672	992	cmd.exe	vssadmin.exe
PID 992 wrote to memory of 672	992	cmd.exe	vssadmin.exe
PID 992 wrote to memory of 672	992	cmd.exe	vssadmin.exe
PID 772 wrote to memory of 1652	772	program.exe	mshta.exe
PID 772 wrote to memory of 1652	772	program.exe	mshta.exe
PID 772 wrote to memory of 1652	772	program.exe	mshta.exe
PID 772 wrote to memory of 1652	772	program.exe	mshta.exe
PID 772 wrote to memory of 1668	772	program.exe	mshta.exe
PID 772 wrote to memory of 1668	772	program.exe	mshta.exe
PID 772 wrote to memory of 1668	772	program.exe	mshta.exe
PID 772 wrote to memory of 1668	772	program.exe	mshta.exe

C:\Users\Admin\AppData\Local\Temp\program.exe
"C:\Users\Admin\AppData\Local\Temp\program.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:772

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\system32\mode.com
mode con cp select=1251
3⤵
PID:1784

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:1240

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\system32\mode.com
mode con cp select=1251
3⤵
PID:1660

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:672

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
2⤵
- Modifies Internet Explorer settings
PID:1652

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
2⤵
- Modifies Internet Explorer settings
PID:1668

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1364

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
MD5
9d7136b3c4e8038b4917bf5bec811ea9

SHA1
5ec43fbdf34601fcb8b7b3e387a1022bff7a51bb

SHA256
8103f22c63c48553aafe4cf682e8b50aa86774e4231ca24d69d97616e1d03230

SHA512
d6b746adb43a271ffb0ca5686b9f894543a3b3286000a16eb35b08a57e0b36a2608b7bad812ae3fc0f48fc7c0486850340449a01367a1b45ff62721a83db09b2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
MD5
9d7136b3c4e8038b4917bf5bec811ea9

SHA1
5ec43fbdf34601fcb8b7b3e387a1022bff7a51bb

SHA256
8103f22c63c48553aafe4cf682e8b50aa86774e4231ca24d69d97616e1d03230

SHA512
d6b746adb43a271ffb0ca5686b9f894543a3b3286000a16eb35b08a57e0b36a2608b7bad812ae3fc0f48fc7c0486850340449a01367a1b45ff62721a83db09b2

Download Submit
memory/672-66-0x0000000000000000-mapping.dmp

Download
memory/772-60-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/992-64-0x0000000000000000-mapping.dmp

Download
memory/1240-63-0x0000000000000000-mapping.dmp

Download
memory/1652-67-0x0000000000000000-mapping.dmp

Download
memory/1652-69-0x000007FEFC181000-0x000007FEFC183000-memory.dmp

Filesize
8KB

Download
memory/1660-65-0x0000000000000000-mapping.dmp

Download
memory/1668-68-0x0000000000000000-mapping.dmp

Download
memory/1784-62-0x0000000000000000-mapping.dmp

Download
memory/2036-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads